Risk Management

Arion Bank faces various risks arising from its day-to-day operations as a financial institution. Managing risk and taking informed decisions is a crucial component of the Bank's activities and its responsibility towards society. Risk management is therefore a core activity within the Bank. The key to effective risk management is a process of ongoing identification of significant risk, quantification of risk exposure, action to limit risk and constant monitoring of risk.

The Board of Directors is ultimately responsible for the Bank’s risk management framework and ensuring that satisfactory risk policies and governance structure for controlling the Bank’s risk exposure are in place. Similarly, the risk management of subsidiaries is the responsibility of that subsidiary. For the parent company (the Bank) the Board sets the risk appetite, which is translated into exposure limits and targets monitored by the Bank’s Risk Management division.

The CEO is responsible for sustaining an effective risk management framework, processes and controls as well as maintaining a high level of risk awareness among the employees, making risk everyone’s business.

The Bank’s Risk Management division is headed by the Chief Risk Officer. It is independent and centralized and reports directly to the CEO.

Further information on Risk Management.

The Bank operates several committees to manage risk. The Board Risk Committee (BRIC) is responsible for supervising the Bank’s risk management framework, risk appetite and internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP). The Asset and Liability Committee (ALCO), chaired by the CEO or his deputy, is responsible for managing the asset-liability mismatch, liquidity risk, market risk, interest rate risk, and capital management. The Underwriting and Investment Committee (UIC) decides on underwriting and investments. The role of the Data Committee (DC) is to ensure the appropriate management of data. The Security Committee (SC) is responsible for security issues, both information security and physical security.

The Bank has three credit committees: The Board Credit Committee (BCC), which decides on all major credit risk exposures; the Arion Credit Committee (ACC), which operates within limits specified as a fraction of the Bank’s capital; and the Retail Branch Committee (RBC), which operate within tighter credit granting limits. There are also five valuation committees whose role is to establish criteria for estimating collateral and also to inspect valuations of securities owned by the Bank.

The most significant risks the Bank is exposed to are credit risk, liquidity risk, interest rate risk, concentration risk, cyber risk and business risk. The Bank’s Pillar 3 Risk Disclosures 2019 report discusses risk factors and risk management in detail.

Capital Adequacy

The Bank’s capital is intended to meet the risk of unexpected losses in its operations. The extent of the Bank’s own funds should reflect the risk at any given time and potential adverse future development. Risk on the Bank’s balance sheet is assessed by calculating the risk-weighted exposure value (REA). The Bank uses a standardized approach for calculating REA which is generally designed to be more conservative than methods based on internal models. Capital is calculated in accordance with the Financial Undertakings Act No. 161/2002 and Regulations on Prudential Requirements for Financial Institutions No. 233/2017, under which the European Union’s capital requirement directives, CRD IV and CRR, both based on Basel III, are being implemented in Iceland. Provisions for a capital charge supporting factor for small and medium enterprises had not been implemented in Iceland at year-end 2019 but came into force in 2020 when the EU Capital Requirements Regulation (CRR) was incorporated into the EEA Agreement. 

The Bank’s total own funds were ISK 173.0 billion at the end of 2019. Of this total, Common Equity Tier 1 capital (CET1) accounted for ISK 152.7 billion. Issuance of subordinated bonds in 2019 contributed to ISK 13.5 billion of new Tier 2 capital, which completes the first phase of capital normalization. . The calculation of own funds at 31 December 2019 accounts for a foreseeable equity reduction of ISK 14.2 billion (adjusted for own shares), which is the aggregation of the Bank's own shares buy-back plan and dividend distribution as approved by the Board of Directors.

The Bank’s REA was ISK 719.8 billion at the end of 2019, decreasing by ISK 76.9 billion over the year. The reduced REA can primarily be attributed to the contraction of the corporate loan book, sale of equity positions and sale of Arion Bank Mortgages Institutional Investor Fund mortgage portfolio. Calculations of the Bank's capital adequacy are based on the Group’s consolidated situation according to prudential requirements and do not take into account subsidiaries in the insurance sector, to which special solvency requirements apply. The Bank’s average risk-weighting (REA as a percentage of total assets of the Group’s consolidated situation) was 68.1%.

The Bank’s capital ratio at the end of 2019 was 24.0% and CET1 ratio was 21.2%.

Capital ratio
Risk-weighted exposure amount

In addition to measuring its minimum capital requirement under Pillar 1 in accordance with the rules on prudential requirements, the Bank also assesses its additional capital requirement by performing an Internal Capital Adequacy Assessment Process (ICAAP). ICAAP is designed to ensure that the Bank has in place sufficient risk management processes and systems to identify, manage and measure the Bank’s total risk exposure. ICAAP is designed to identify and measure the Group’s risk across all risk types, including those which are not provided for under Pillar 1, and to ensure that the Group has sufficient capital in accordance with its risk profile. The Financial Supervisory Authority (FME) supervises the Group, receives the Group’s internal estimate of capital adequacy and sets additional capital requirements for the Group following a Supervisory Review and Evaluation Process (SREP). The capital adequacy in respect of the FME's evaluation, in addition to the mandatory Pillar 1 requirement of 8% of REA, is called an additional capital requirement under Pillar 2. The Pillar 2 additional requirement, determined on the basis of the Group’s financial position as at the end of 2019, is 3.1% of REA and this figure is based on the Group’s consolidated situation which excludes subsidiaries in the insurance sector.

Under the Financial Undertakings Act No. 161/2002 the Bank must meet a combined capital buffer requirement, which is designed to ensure that the Bank maintains a minimum level of capital despite severe shocks. The FME has decided on the level of capital buffer in accordance with a proposal from the Financial Stability Council and it has defined Arion Bank as a systemically important financial institution in Iceland. The combined capital buffer requirement was 9.25% at the end of 2019. Effective capital requirements for the countercyclical capital buffer are determined using the weighted average capital buffer in the countries where the Bank has exposure and risk-weighting is decided by the percentage of credit risk in RWA. Furthermore, the systemic risk buffer only applies to domestic exposures. The other capital buffers are the capital conservation buffer and the buffer for systemically important financial institutions. The effective combined capital buffer for the Bank was 9.0% at the end of the 2019. FME has announced a 0.25% increase to the countercyclical capital buffer which will raise the Group’s combined effective capital buffer to 9.2% effective as of February 2020.

Introduction of capital buffers
Capital ratio and total capital requirement taking into account management buffer
The Group’s total own funds meet the total capital requirement in respect of Pillar 1, Pillar 2 and capital buffers. The total requirement, with fully loaded capital buffers, is 20.3% of REA while own funds are 24.0% of REA. The Bank also sets an internal management buffer of 1-2% of REA. The FME can also set a capital target (Pillar 2G) on top of Pillar 1, Pillar 2 and capital buffers on the basis of stress test results.

Credit risk

Credit risk is defined as the current or prospective risk to earnings and capital arising from the failure of an obligor to discharge an obligation at the stipulated time or otherwise to perform as agreed. Loans to customers and credit institutions are by far the largest source of credit risk.
Loan book composition

Strong mortgage portfolio with low default rates and high loan-to-value

Mortgages are a core product for Arion Bank. The mortgage portfolio represented 42% of the total loan portfolio at the end of the year, up from 12% since the end of 2010. The key to the growth of the mortgage portfolio was the acquisition of a mortgage portfolio from Kaupthing in 2011 and the acquisition of retail loan portfolios, coupled with strong organic growth via new mortgage lending. The Bank has been at the forefront of innovation on the mortgage market, offering for example, non-indexed mortgages and digital solutions for mortgage financing. At the end of 2019 non-indexed mortgage loans represented 39% of the mortgage portfolio, the remainder being CPI-linked loans.
Mortgage portfolio growth and composition
ISK bn.

The quality of the mortgage portfolio has improved in recent years with lower average loan-to-value and a reduction in default rates, but last year the default rates increased slightly.

Mortgage portfolio growth and composition
Mortgage portfolio by location
At the end of 2019, 87% of the mortgages, by value, had loan-to-value below 80%, the same as at the end of 2018. The great majority of mortgage property is located in the Greater Reykjavík area or 69% of the portfolio value.
Loan to value of mortgage loans
ISK bn.

Well diversified loan portfolio

Loans to customers are well diversified. Loans to individuals represent 48% of total loans to customers, of which 84% are due to mortgages. The corporate portfolio is mainly in three sectors: real estate and construction, fishing and fish processing and wholesale and retail trade, which represent 32%, 20% and 14% of the corporate portfolio respectively. Although sector diversification is good, some single name concentration remains.
Loan book concentration
Industry sector concentration of corporate loans

Single name concentration decreasing

At the end of 2019 the Bank had one single exposure to a group of related parties, excluding exposure to financial institutions, that exceeded 10% of the Bank's eligible capital (so-called large exposures). The sum of related exposures, excluding loans to financial institutions, exceeding 2.5% of own funds has increased from the previous year – it was 148% at the end of 2019, compared with 144% at the end of 2018.
Single name concentration

Collateral coverage of loans to customers

Mortgages over residential properties and charges over commercial real estates are the most common types of collateral obtained by the Bank, representing 78% of total collateral. Fishing vessels and other fixed and current assets, such as cash and securities, are also used to secure loans. The Bank places emphasis on collateral maintenance, valuation and central storage of collateral information. At the end of 2019 loans to customers (gross value ISK 773,955 million) are secured by collateral valued at ISK 694,724 million, giving a collateral coverage ratio of 90%, but as shown in the following diagram this ratio varies between different sectors.
Collateral coverage of loans to customers in 2019 down to sectors
Collateral by type

Loan book quality is steadily improving

The Bank defines Problem loans as loans in the third and highest risk stage according to the IFRS 9 accounting standard. At the end of 2019 the Problem loan ratio was 2.6% and remains unchanged between years, and 27% of these loans are in default without being impaired due to sufficient collateral.
Problem loans
Breakdown of problem loans

Operational risk

Operational risk is the risk of direct or indirect loss, or damage to the Bank's reputation resulting from inadequate or failed internal processes or systems, from human error or external events that affect the Bank's image and operational earnings. Business risk, strategic risk, legal risk, conduct risk, model risk and IT risk are among others subcategories of operational risk.

Each business unit within the Bank is responsible for taking and managing its operational risk. The Bank’s Operational Risk department is responsible for developing and maintaining tools for identifying, measuring, monitoring and controlling operational risk. The operational risk management framework is based on the effectiveness of managing processes, their risks and controls, analyzing deviations from best practices and continuously improving the operation. 

Market risk

Market risk is defined as the risk that market price changes and interest rate changes will affect the value and cash flow from the Bank’s financial instruments with a negative effect on the Bank's earnings and capital. The main risk factors are interest rate risk, indexation risk, equity price risk and foreign exchange risk.

Interest rate risk is primarily related to the fact that in part of the balance sheet there is a mismatch between maturities and interest-fixing periods of interest-bearing assets and liabilities. At year-end 2019 the Bank had a short net position in both nominal and indexed krona interest rates, which means that the average duration of fixed rates for the Bank’s liabilities exceeds that of its assets. Lower nominal or indexed rates would therefore result in depreciation of the net fair value of interest bearing assets and liabilities. The relationship between inflation and interest rates should be considered in this context. A decrease in nominal rates is often accompanied by a lowering of inflation or expectations thereof and lower inflation reduces the Bank’s net interest earnings as the Bank’s indexed assets exceed its indexed liabilities, see below. The Bank’s sensitivity to changes to foreign interest rates is limited.

The liquidation of ABMIIF in October 2019 significantly shortened the Group’s interest fixing profile, which reduces interest rate risk. Below we show the Group’s sensitivity to changes to interest rates. The Bank’s calculations of interest rate sensitivity take prepayment risk and behavioral duration of non-maturing deposits into account.

Sensitivity to interest rate movements – loss in fair value (not book value) due to a parallel shift of yield curves upwards by 1%
ISK millions

The Bank has managed to substantially reduce equity price risk through a structured sale timetable in the last few years. At the beginning of 2016 the Bank’s holding in Bakkavör Group Ltd. was sold, bringing the Bank’s position in associate companies to a negligible level. In 2018, the Bank divested its shares in the beverage manufacturer Refresco and in 2019 the Bank sold its shares in Stoðir hf. The Bank’s position in other listed equity has also decreased significantly in recent years following further asset divestment.

The Bank’s position in equities in the proprietary trading book and in respect of securities margin lending was relatively stable in the last year. Risk Management closely monitors the associated risk and ensures that positions are kept within limits and that collateral is in place.

Equity positions
ISK millions

Foreign exchange risk is the risk that movements in the exchange rate of the Icelandic króna could have a negative impact on the Bank's earnings. The Group’s currency imbalance at the end of 2019 was negative ISK 9.9 billion. The Bank uses derivatives to hedge against foreign exchange risk.

The net position of the Bank’s indexed assets and liabilities at the end of 2019 was ISK 88.9 billion, decreasing by ISK 12 billion from the previous year. The decrease is explained by prepayments of indexed loans, issuance of indexed covered bonds and new derivatives positions.

Currency imbalance
ISK bn.
Indexation imbalance
ISK bn.

Liquidity Risk

Liquidity risk is defined as the risk that the Group, though solvent, either does not have sufficient financial resources available to meet its liabilities when they fall due or can secure them only at excessive cost.

The Bank also carries out an Internal Liquidity Adequacy Assessment Process, or ILAAP. This process is designed to ensure that the Bank has sufficient liquidity and that appropriate plans, policies, methods and systems are in place to analyze, manage and monitor liquidity risk.

The Central Bank of Iceland monitors the Bank’s compliance with requirements and obligations in respect of liquidity risk.

Further on Liquidity Risk